Cyber-defense is much different from traditional military preparedness in many ways. One of the biggest differences is the role of the private sector. Before we get to the role of business in our national defense, I would like to go on record as saying that use of terms like "cyber-warfare" tend to separate traditional military defense from computer security. Instead, all discussions about national defense must include electronic infrastructure. Planning separation should only occur when focusing on unique defensive requirements and how all components integrate into an overall shield--both offensive and defensive. Now that I have that out of my system... As I see it, the weak link in our national defense is the increasing role business security plays in protecting our economy. An attack against our country will seek to do two things. First, it will target our military's ability to wage war. Second, it will attempt to cripple financial and public services to the point at which capitulation begins looking like our only public welfare alternative. Military preparedness alone cannot block the second military objective. Our economy is largely based on private organizations responsible for their own security. And even though government regulations exist, they exist largely to protect voter privacy--to assuage the electorate between trips to the ballot box. So what does this mean to our national defense? It means that without a coordinated effort by both public and private security teams, no integrated defense is possible. It means we may be able to successfully wage a traditional battle with tanks and bombs while we lose the war because our financial, healthcare, and other critical institutions are crippled or fully inoperable. Again, the first step is integration of electronic defense into our overall defensive/offensive strategy--including critical private sector infrastructure. This won't be easy in a country where private individuals and businesses strongly prefer the government to stay out of their way. But things are different now, and our potential future enemies don't have this issue. Part of integration is understanding what a "cyber war" is. After years of discussions and several high-profile breaches of military and civilian targets, we still don't seem to get it.

One problem with a cyber warfare policy is the lack of definition of what constitutes an act of cyber war, Kurtz added. There's no line separating what constitutes a simple cyber attack from cyber war, he said. With no definitions in place, it's hard to have a public debate about what the U.S. government's cyber warfare policy should be, he said. In addition, it may not be wise to label some countries as cyber adversaries, he said. Although the Chinese government often gets blamed for sponsoring cyber attacks, the U.S. government needs to engage the Chinese about cyber defense, Kurtz said.Source: U.S. cyber war policy needs new focus, experts say, Grant Gross, Computerworld, 29 October 2009

It's time to stop talking about what to do and actually get to work. Our counterparts in other countries are not sitting on their hands.

Some name

Tom Olzak is an independent security researcher and an IT professional with over 38 years of experience in programming, network engineering and security. He has an MBA as well as CISSP certification. He is also an online instructor for the University of Phoenix, and has held positions as an IS director, director of infrastructure engineering, director of information security, and programming manager at a variety of manufacturing, healthcare, and distribution companies. Before joining the private sector, Tom served 10 years in the United States Army Military Police with four years as a military police investigator. He's written four books,
Just Enough Security,
Microsoft Virtualization,
Enterprise Security: A
Practitioner's Guide, and
Incident Management and Response Guide. He is also the author of various papers and articles on security management.

Independent security researcher and IT professional with over 36 years of experience in programming, network engineering and security. Author of four books (Just Enough Security, Microsoft Virtualization, Enterprise Security: A Practitioner's Guide, and Incident Management and Response Guide) and various papers on security management.

I agree with evrything you say, but it has been said many times by many others. How can we get the necessary integration and activity you speak of without a profit motive for the private sectors? It would seem that the private sectors will expect government to subsidize the cost of necessary security defenses, etc. - but who wants to pay more taxes to do it?

As regards the definition, much of the problem lies in an inability to trace origins of attacks. If we respond against the wrong source, we become the aggressors. And yes, other countries are not sitting on their hands, but neither are we. There are offensive capabilities that never get discussed. And we also don't hear much about how other countries approach defense against cyberwarfare. Do our potential adversaries plan to just ""leave their doors open?""